CVE-2025-34106: PDF Shaper Buffer Overflow Vulnerability

CVE-2025-34106 Overview

CVE-2025-34106 is a buffer overflow vulnerability in PDF Shaper versions 3.5 and 3.6. The flaw resides in the Convert PDF to Image functionality exposed through the PDFTools.exe component. An attacker crafts a malicious PDF and lures a victim into processing it with the affected feature. Successful exploitation leads to arbitrary code execution under the context of the current user. The issue has been verified across Windows XP, 7, 8, and 10. The weakness is classified as [CWE-119] improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Arbitrary code execution in the user's context through a single crafted PDF file processed by the conversion utility.

Affected Products

PDF Shaper 3.5 (PDFTools.exe)
PDF Shaper 3.6 (PDFTools.exe)
Windows XP, 7, 8, and 10 hosts running the affected versions

Discovery Timeline

2025-07-15 - CVE-2025-34106 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-34106

Vulnerability Analysis

The vulnerability stems from unchecked buffer handling inside the Convert PDF to Image routine of PDFTools.exe. When PDF Shaper parses a crafted PDF, oversized or malformed fields overflow a fixed-size stack buffer. The overflow overwrites adjacent stack data, including the saved return address. An attacker who controls the return address can redirect execution into attacker-supplied shellcode embedded in the PDF. The flaw maps to [CWE-119] and yields code execution at the privilege level of the user who launched PDF Shaper.

A public Metasploit module (exploits/windows/fileformat/shaper_pdf_bof) and an Exploit-DB entry (37760) demonstrate reliable exploitation. The EPSS probability is 0.33% as of 2026-06-29.

Root Cause

The conversion routine copies attacker-controlled PDF data into a stack buffer without validating its length. Standard exploitation patterns such as SEH overwrite or direct return-address corruption apply. The affected versions ship without modern mitigations enabled consistently on legacy Windows targets, simplifying reliable shellcode execution.

Attack Vector

Exploitation requires local user interaction. The attacker delivers a malicious PDF through email, web download, or shared storage. The victim opens the file in PDF Shaper and selects the Convert PDF to Image option. Parsing the document triggers the overflow, transferring execution to attacker-controlled shellcode running with the user's privileges.

No verified code examples are published in this advisory. Refer to the Metasploit exploit module and Exploit-DB #37760 for technical proof-of-concept details.

Detection Methods for CVE-2025-34106

Indicators of Compromise

Execution of PDFTools.exe followed by unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Crashes or access-violation events in PDFTools.exe recorded in the Windows Application event log.
Suspicious PDF files opened from temporary download or email attachment directories prior to PDFTools.exe activity.
Outbound network connections initiated by PDFTools.exe, which has no legitimate need for network egress.

Detection Strategies

Hunt for process trees where PDFTools.exe spawns interpreter, scripting, or LOLBin processes.
Alert on Windows Error Reporting events referencing PDFTools.exe module faults at unusual offsets.
Inspect PDF samples with static analysis tools for malformed object streams or oversized field values targeting the converter.

Monitoring Recommendations

Forward Sysmon process-creation and image-load events for PDFTools.exe to a centralized log platform.
Track file-write events that place PDF files in user-writable paths immediately before PDF Shaper execution.
Baseline normal PDF Shaper behavior and alert on deviations such as new network sockets or memory allocations marked executable.

How to Mitigate CVE-2025-34106

Immediate Actions Required

Discontinue use of PDF Shaper 3.5 and 3.6 for opening untrusted PDF files.
Remove the affected PDFTools.exe binaries from endpoints where they are not required.
Restrict execution of PDF Shaper through application allowlisting until a fixed release is verified.
Educate users on the risk of opening PDF attachments from untrusted senders.

Patch Information

No vendor advisory or fixed version is referenced in the available data. Consult the PDF Shaper website and the Vulncheck advisory for the latest vendor guidance. Where a patched build is unavailable, replace PDF Shaper with a maintained PDF conversion utility.

Workarounds

Block PDFTools.exe execution using Windows Defender Application Control or AppLocker policies.
Open untrusted PDFs only inside a sandboxed virtual machine isolated from production data.
Enforce Data Execution Prevention (DEP) and mandatory ASLR system-wide via Exploit Protection settings.
Strip executable permissions from any PDF Shaper installation directory accessible to standard users.

bash

# Configuration example: AppLocker rule to block PDFTools.exe (PowerShell)
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny `
    -PathCondition "%PROGRAMFILES%\PDF Shaper\PDFTools.exe" `
    -RuleNamePrefix "Block-PDFShaper-CVE-2025-34106"

# Enable system-wide DEP for all processes
bcdedit.exe /set {current} nx AlwaysOn